5 ms·
It's not Signal's job to work around deficient carrier tools.
by corndoge 5y ago
It's not Signal's job to work around deficient carrier tools.
- junon 5y agoIt's not Signal's job nor their place to weaponize their users' devices without permission. This is incredibly unethical.
- thecrash 5y agoYou're fabricating complications which don't make any technical sense as a justification to be angry about this basically harmless gesture. If you are that averse to the idea of being even remotely complicit in jamming the surveillance state, just don't use Signal.
- junon 5y agoFirstly, never has it been a requirement to "jam the surveillance state" to be a user of Signal. That's absolutely bananas. Did you read the text at the bottom of the post? They are randomly installing malware on users' devices to break or harm or otherwise self-destruct when Cellebrite machines read them. I'm not speaking for myself. I would opt in personally. I'm speaking for my mother who just wants a secure and reliable line of communication with her son without being pulled into some offensive scheme that could land HER in trouble or cause damages. If something is broken or destroyed without user knowledge or understanding or consent, you better believe Signal will see court cases.
- jamespo 5y agothere are plenty of other options than Signal, vote with your feet
- junon 5y agoName another privacy respecting application that can do calling and video between two phones with e2ee and is simple enough for a 65 year old non-tech-savvy woman to use. I'll switch her over immediately.
- quitethelogic 5y agoThe exploit targets Cellebrite, not Signal's own software. Cellebrite is running on the machine doing the extracting and not the device containing the original data. It's entirely possible that I'm wrong and this will cause your phone to explode, but if you don't trust the Signal developers enough to assume they won't intentionally explode your phone, you probably shouldn't be using their product.
- junon 5y agoI understand this. I'm saying my mother shouldn't be on the hook for her phone bricking a celebrity device used in good faith.
- amscanne 5y agoMy reading is that the owner of any device the provider previously plugged in to could exfiltrate your mother's data by installing a persistent backdoor. Since this is a phone, I assume this includes email, passwords, etc. and they could use this data to e.g. access your mother's financial accounts. This is a fantastic vector for criminals. Signal is providing a strong, albeit rude (likely in response to Cellebrite's claims), incentive to fix their shit. Would you rather have a temporary period where transfers weren't working, or deal with the scenario above in a year?
- junon 5y ago> weren't working If that were the case, fine. But the post does not specify the effect of the "aesthetically pleasing" files. They could destroy all Signal data or irreversibly harm the machine itself. We just have to "trust" the Signal devs to not do that? This is not how security should work.
- amscanne 5y agoHuh? Don't you trust the Signal devs to not destroy all Signal data every day? You're trusting the Signal devs to your keep messages safe and secure. I don't know if that means wiping all messages when accessed via Cellebrite, but that seems like a reasonable option. My assumption would be that they will just crash or brick the Cellebrite software. Either way and completely independently of the aesthetically pleasing files, if you disagree with the choices Signal makes to keep your messages safe and secure, there are many other messaging options that you can use. Publicly calling out big security problems is exactly how security should work (notwithstanding specifics of disclosure).
- junon 5y agoBecause when my mother has to transfer her phone, she'll then be liable for thousands of dollars of damage to their property, and she'd otherwise have no idea why. That's the problem. The fact nobody sees the effects of this is absolutely surreal and alarming.
- edenhyacinth 5y agoI think what you're missing is that Signal does not need to place any files on any phones for their purpose, and likely will not ever do so. Their intention is to render using Cellebrite for court evidence worthless by suggesting that the record could have been tampered with at any point, if any phone the user scanned had Signal on it. Proving that no phones ever had an 'aesthetic' file that could cause damage to Cellebrite is impossible, and they've provided clear reason why it is impossible to prove.
- GuB-42 5y agoMaybe, but an app that does what Moxie suggests is malware in my book. I don't think Signal will do that though, if it does, it will most likely get kicked out of every store and the company will most likely end up in well-deserved legal trouble, as if MOB wasn't shady enough... As someone else said, it is more likely to be a way to discredit evidence extracted by Cellebrite.
- ruined 5y agocellebrite is exactly the kind of threat signal is intended to foil. if you want cellebrite reading your messages, you are not the target userbase of signal. this is like complaining that “rm” deleted your files.
- GuB-42 5y agoEven if I am not the target userbase of Signal, which is partly true, by using it, I benefit those who really need it for its privacy features. The millions of users like me who do nothing sensitive with it add bulk to traffic, making it harder to single out "interesting" data. I mean, for example, if only criminals used Signal, just having the app will get you a lot of attention from the police, as it happened with Encrochat.